CVE-2024-57892 ocfs2: fix slab-use-after-free due to dangling pointer dqi_priv
A use-after-free vulnerability in the Linux kernel's OCFS2 filesystem allows attackers to potentially execute code or escalate privileges via quota operations.
- Exploited in the wild
- Not known
- Login needed
- Any signed-in user
- Attackable
- Local or same network only
- Victim action needed
- Not needed
- Fix
- Available
What is CVE-2024-57892?
CVE-2024-57892 is a high-severity use after free vulnerability in Linux kernel, published on 15 Jan 2025. It can only be exploited from the same machine or local network, with no action from the victim.
Official description
In the Linux kernel, the following vulnerability has been resolved:
ocfs2: fix slab-use-after-free due to dangling pointer dqi_priv
When mounting ocfs2 and then remounting it as read-only, a slab-use-after-free occurs after the user uses a syscall to quota_getnextquota. Specifically, sb_dqinfo(sb, type)->dqi_priv is the dangling pointer.
During the remounting process, the pointer dqi_priv is freed but is never set as null leaving it to be accessed. Additionally, the read-only option for remounting sets the DQUOT_SUSPENDED flag instead of setting the DQUOT_USAGE_ENABLED flags. Moreover, later in the process of getting the next quota, the function ocfs2_get_next_id is called and only checks the quota usage flags and not the quota suspended flags.
To fix this, I set dqi_priv to null when it is freed after remounting with read-only and put a check for DQUOT_SUSPENDED in ocfs2_get_next_id.
[[email protected]: coding-style cleanups]
Weakness: CWE-416
Which versions are affected by CVE-2024-57892?
It affects 1 product.
Products include Linux kernel.
How do I fix CVE-2024-57892?
Apply the vendor's patch.
Upgrade to the fixed version. These bugs are found with fuzzing and sanitisers and avoided by memory-safe languages. More about Use after free.
Is CVE-2024-57892 being exploited?
There is no known exploitation of CVE-2024-57892 in the wild and no public exploit code.
Other vulnerabilities in Linux kernel
Sources
Also known as BELL-CVE-2024-57892, DEBIAN-CVE-2024-57892, GHSA-xmg9-vq9f-g4cr, UBUNTU-CVE-2024-57892.